8138513e135bdb80541b63fdfba6a47a875720fa27f9d55d80421d31ff03bf2c | Triage

Sharing

General

Target

8138513e135bdb80541b63fdfba6a47a875720fa27f9d55d80421d31ff03bf2c
Size

9.3MB
Sample

220511-c639cadhe5
MD5

74d3c4a15e2bc8281a91c5586fab7367
SHA1

9b77d7450813c88b7f4514174e79da6879414b3a
SHA256

8138513e135bdb80541b63fdfba6a47a875720fa27f9d55d80421d31ff03bf2c
SHA512

c2525c60dedc9d35ddb73a2604d9a5515e1b8d4a1a480cbd6a7093a39790bcd4884d4bd2b2193dca6927aae99f56e9231ee23f8083a1f555926f240966482419

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  8138513e135bdb80541b63fdfba6a47a875720fa27f9d55d80421d31ff03bf2c
- Size
  
  9.3MB
- MD5
  
  74d3c4a15e2bc8281a91c5586fab7367
- SHA1
  
  9b77d7450813c88b7f4514174e79da6879414b3a
- SHA256
  
  8138513e135bdb80541b63fdfba6a47a875720fa27f9d55d80421d31ff03bf2c
- SHA512
  
  c2525c60dedc9d35ddb73a2604d9a5515e1b8d4a1a480cbd6a7093a39790bcd4884d4bd2b2193dca6927aae99f56e9231ee23f8083a1f555926f240966482419
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

behavioral2